How Many C3PAOs Are There? The Real Numbers Behind the Shortage

As of the Cyber AB’s September 29, 2026 Town Hall, there were 117 authorized or accredited C3PAOs, 1,179 CMMC Certified Assessors (CCAs), 681 Lead CCAs and 2,199 CMMC Certified Professionals. The program had issued 2,362 final Level 2 certificates, with 151 assessments in progress.

Those numbers have been growing every month, and they tell a more interesting story than the one most people repeat. There’s no shortage of credentialed assessors in the aggregate. There’s a shortage of the right Lead CCA, available on your dates.

Ten months of growth

In ten months the assessor counts nearly doubled, while the number of C3PAOs grew by about a quarter. Certificates grew fastest of all, more than fourfold, and kept climbing 12 to 13 percent a month through the summer even after Phase 2 was suspended in July. The Cyber AB’s August and September decks said it in capital letters: “The CMMC Program itself IS NOT ‘PAUSED’.”

The pace, month by month

Averaged over the nine months from December to September, the program issued about 200 final Level 2 certificates a month, and September alone added 257. Assessments in progress peaked at 168 in July and eased to 151 by September, even as certificates kept rising, a pattern consistent with work already underway finishing while fewer new assessments started.

The assessor side grew in steps rather than a smooth line. The largest jump came between the April and May decks, when CCAs went from 766 to 988, and part of that is bookkeeping: the May deck restated April’s count upward to 858. That’s one reason we take each month from its own presentation rather than mixing them.

The ratio that matters most moved the right way too. In December there were about four Lead CCAs for every C3PAO (377 to 93). By September there were nearly six (681 to 117).

For a sense of where this is heading, the rule’s own analysis assumed about 4,452 C3PAO-led assessments a year once the program was fully phased in, roughly 370 a month. Certificates and assessments aren’t the same count, but the gap between about 200 a month now and that assumption is the room the ecosystem still has to grow into.

So is there a shortage?

Not in the way the headlines mean. The Cyber AB’s June deck put it bluntly on a “Mythbusters” slide: “There is no CCA ‘shortage’,” and C3PAO Level 2 certification assessments “are currently available NOW.”

An outside analysis points the same way. Secureframe pulled every active Cyber AB Marketplace listing in March 2026 and modeled how much of the assessor pool was actually being used. Its conclusion: “the ecosystem has consistently been utilized below half its realistic capacity.” Its conservative case put utilization around 59 percent; its best guess, around 39 percent (Secureframe). It’s a vendor’s model, not a count, but it’s the most thorough public estimate there is.

The demand side is bigger than today’s volume. The CMMC rule’s own analysis estimated that “8,350 medium and large entities will require CMMC Level 2 certification assessments,” ramping to 4,452 C3PAO-led assessments a year by its fourth year (89 FR 83092, at 83170). Capacity has room to grow into that, and it’s growing.

Where the real constraint sits

The numbers that matter to a single C3PAO aren’t national totals. They’re three narrower ones.

Then there’s the pipeline itself. The credential path is long by design, and the slowest step isn’t training. The Cyber AB’s August deck said plainly that “DCSA’s Tier 3 process is cumbersome and takes exceedingly long to adjudicate.” An assessor who passes the exam can still wait months to be cleared to assess.

Put together, the shortage a C3PAO actually feels is specific: an experienced Lead CCA, free the week an OSC is ready, without a full-time salary attached to the weeks they aren’t needed.

If you’re an OSC trying to book

National totals don’t tell you whether a particular C3PAO can assess you when you need it. A few questions do:

1. Who will be our Lead CCA, by name? Every assessment needs one, and Lead CCAs are the scarce credential. A C3PAO that can name yours has actually planned the engagement.
2. What’s your lead time from contract to Phase 1? Ask what drives it, and whether checkpoints and an optional mock fit inside it.
3. What happens if an assessor drops out? Illness, a conflict of interest discovered late, a background check that hasn’t cleared. A C3PAO with a bench behind its team has an answer.
4. Who does quality assurance? The rule requires a separate CCA, not on the team, to review each assessment (§ 170.9(b)(13)–(14)). It’s a fair question about how they staff it.
5. Are you authorized or accredited? The Cyber AB Marketplace shows each C3PAO’s current status. An applicant can’t certify you yet.

If you’re a C3PAO planning capacity

Plan around Lead CCAs, not CCAs. Every team needs a lead, so how many assessments you can run in a given stretch depends far more on your Lead CCAs’ calendars than on how many CCAs you can call. Add the quality assurance reviewer, who can’t be on the team, and the readiness reviews and checkpoints that happen before Phase 1, and the binding constraint is almost always an experienced lead with an open week.

Reading these numbers

Each figure is a snapshot, and the decks sometimes restate earlier months, so we’ve taken each month from its own presentation. “Applicant” C3PAOs aren’t authorized ones, and the C3PAO count changed its label in July to include ISO/IEC 17020-accredited organizations. We’ll update this post as new Town Hall figures come out.

That gap between a growing national pool and one C3PAO’s calendar is exactly what assessor capacity for C3PAOs is built for, and Borrow the Bench explains how it works.

Sources: Cyber AB monthly Town Hall presentations, December 2025 to September 29, 2026 (cyberab.org/News-Events/Town-Halls); Secureframe, “CMMC ecosystem” analysis (March 2026 Marketplace data); 32 CFR § 170.9(b)(12)–(13); CMMC Program final rule, 89 FR 83092 (October 15, 2024), regulatory impact analysis at 83154, 83170 and 83186.